Overview of incoming advisories.
1553 results found
A buffer overflow vulnerability has been identified in the Tenda HG10 router (firmware version 300001138). The flaw exists in the formWanRedirect function within the /boaform/formWanRedirect file, part of the Boa Web Server component. An attacker can exploit this vulnerability by manipulating the 'if' argument to trigger a buffer overflow condition. The attack can be launched remotely without requiring physical access to the device. A public exploit has already been disclosed, increasing the risk of active exploitation. This vulnerability poses a significant risk to users of the affected Tenda HG10 device. The issue has been catalogued in VulDB and the National Vulnerability Database. IoT and home networking devices such as this are commonly targeted due to limited patch adoption by end users.
View original advisory →A SQL injection vulnerability has been identified in SourceCodester Online Voting System version 1.0. The flaw exists in the /ajax.php?action=save_user file, where manipulation of the 'ID' argument allows for SQL injection attacks. The vulnerability can be exploited remotely without requiring physical access to the system. A public exploit has already been published and is available for use by threat actors. The issue affects an unknown function within the identified file. This type of vulnerability can allow attackers to read, modify, or delete database contents, potentially compromising the integrity of voting data. The vulnerability has been catalogued in VulDB and NVD databases. Given the sensitive nature of online voting systems, exploitation could have significant implications for election integrity.
View original advisory →The HivePress Authentication plugin for WordPress (versions up to and including 1.1.4) contains a critical authentication bypass vulnerability via the access_token parameter. The flaw exists in the authenticate_user function's Facebook authenticator, which forwards attacker-supplied access tokens to the Facebook Graph API and blindly trusts the returned email and ID without validating the application ID or audience. No /debug_token verification is performed, and the token's app_id is never compared against the configured hp_facebook_app_id. This allows unauthenticated attackers to impersonate any WordPress user, including administrators, if the victim's email is linked to a Facebook account. Exploitation requires the attacker to obtain a valid Facebook access token for the victim. A patch has been committed to the plugin repository addressing the missing token validation logic.
View original advisory →A SQL injection vulnerability has been identified in SourceCodester Class and Exam Timetabling System version 1.0. The vulnerability exists in the mysqli_query function within the file /admin/modal_add_product.php. An attacker can exploit this vulnerability by manipulating the 'fname' argument to execute arbitrary SQL commands. The attack can be carried out remotely without requiring physical access to the system. A public exploit has already been disclosed, increasing the risk of active exploitation. The vulnerability affects the database interaction layer of the application, potentially exposing sensitive data. This issue is tracked under CVE-2026-86224 and has been documented on NVD, VulDB, and GitHub.
View original advisory →A SQL injection vulnerability has been identified in SourceCodester Class and Exam Timetabling System version 1.0. The vulnerability exists in the mysqli_query function within the file /admin/modal_add_room.php. An attacker can manipulate the room_name argument to inject malicious SQL code. The attack can be executed remotely without requiring physical access to the target system. A public exploit is already available, increasing the risk of active exploitation. The vulnerability affects the database layer of the application, potentially allowing unauthorized data access or manipulation. Users of this system are advised to apply patches or mitigations immediately given the public availability of the exploit.
View original advisory →A vulnerability was identified in Tenda CP3 firmware version 27.5.57.101 affecting the function sub_2F77E8 in the file Apis/system.c within the Network Configuration Management component. The flaw allows attackers to perform OS command injection through manipulation of the affected function. The attack can be initiated remotely without requiring physical access to the device. This type of vulnerability is particularly dangerous as it can allow full system compromise via arbitrary command execution. The affected product is a networking device manufactured by Tenda, a Chinese networking hardware company. No patch or mitigation details are mentioned in the article. The vulnerability has been assigned CVE-2026-86151 and is tracked in both NVD and VulDB databases.
View original advisory →OpenMAIC versions before 1.0.1 contain a Server-Side Request Forgery (SSRF) vulnerability that bypasses validation in non-production builds. Unauthenticated attackers can supply arbitrary provider URLs through the x-base-url header or baseUrl parameter. This allows attackers to reach cloud instance metadata services and access sensitive cloud credentials. The vulnerability exists due to environment-gated URL validation being skipped outside of production environments. The fix was introduced in OpenMAIC version 1.0.1. The issue affects the image generation API route and middleware components. Exploitation could lead to exposure of sensitive cloud infrastructure credentials and metadata. No authentication is required to exploit this vulnerability, increasing its severity.
View original advisory →A SQL injection vulnerability has been identified in rabindralamsal's inventory-management-system version 1.0.0. The flaw exists in the index.php file within the Login component, where manipulation of the username and/or password arguments can lead to SQL injection. The vulnerability is remotely exploitable, meaning an attacker does not need local access to the system. A public exploit has already been published, increasing the risk of active exploitation. The affected product is a web-based inventory management application. No authentication is required to exploit the vulnerability, as it resides in the login functionality. This represents a significant risk to organizations running this software version.
View original advisory →CVE-2022-51009 affects PocketMine-MP versions before 4.7.2, where improper exception handling in the adhocore/json-comment library leads to a denial-of-service vulnerability. Attackers can exploit this by sending malformed login or skin packets containing invalid JSON geometry data. This triggers an unhandled RuntimeException that causes the game server to crash. The vulnerability requires no authentication, making it trivially exploitable by any network-reachable attacker. The fix was introduced in PocketMine-MP version 4.7.2. A patch commit is available on GitHub along with a published security advisory. The issue highlights risks associated with insufficient input validation and exception handling in third-party library integrations. Server operators are advised to upgrade immediately to mitigate the risk of targeted denial-of-service attacks.
View original advisory →The Frontend Admin by DynamiApps plugin for WordPress (versions up to and including 3.29.12) contains a critical authentication bypass vulnerability allowing unauthenticated attackers to perform full account takeover. The flaw resides in the pre_update_value function, which lacks capability or ownership checks, and in ActionPost::conditions_logic(), which short-circuits its authorization gate when the post ID is non-numeric (e.g., 'user_1'). This allows unauthenticated form submissions to be routed to arbitrary user records. An attacker can overwrite any user's registered email address, including administrators, and then exploit WordPress's native password-reset flow to fully compromise the targeted account. No authentication is required to exploit this vulnerability. A patch was released in changeset 3664865. The vulnerability is tracked by Wordfence and published on NVD.
View original advisory →A SQL injection vulnerability has been identified in SourceCodester Class and Exam Timetabling System version 1.0. The vulnerability exists in the /delete_user.php file, where manipulation of the 'ID' argument allows SQL injection attacks. The vulnerability can be exploited remotely without requiring physical access to the system. A public exploit has already been released, increasing the risk of active exploitation. The affected product is a web-based academic scheduling application. Attackers could leverage this flaw to manipulate or extract database contents. The vulnerability is tracked as CVE-2026-86209 and has been published on NVD and VulDB. No patch or mitigation details are currently provided in the advisory.
View original advisory →A SQL injection vulnerability has been identified in SourceCodester Online Voting System version 1.0. The vulnerability exists in the /ajax.php?action=delete_voting file, where manipulation of the 'ID' argument allows for SQL injection attacks. The attack can be launched remotely without requiring physical access to the target system. A public exploit has been disclosed and is available for use, increasing the risk of exploitation. The vulnerability affects an unknown function within the identified file. Attackers could potentially manipulate the database through this injection point. The issue has been assigned CVE-2026-86160 and is tracked in multiple vulnerability databases including NVD and VulDB.
View original advisory →A SQL injection vulnerability was identified in SourceCodester Online Voting System version 1.0. The flaw exists in the /ajax.php?action=login file, where manipulation of the Username argument allows an attacker to perform SQL injection. The attack can be executed remotely without requiring physical access. The exploit has been publicly disclosed, increasing the risk of active exploitation. This vulnerability affects the login functionality of the web-based voting application. Successful exploitation could allow attackers to bypass authentication or extract sensitive database information. The vulnerability was reported and tracked under CVE-2026-86162.
View original advisory →A denial-of-service vulnerability exists in h3 versions prior to 2.0.1-rc.18, affecting the setChunkedCookie() and deleteChunkedCookie() functions. The library fails to validate the chunk count parsed from user-controlled cookie values, allowing attackers to send a crafted cookie header with an extremely large chunk count. This triggers an O(n²) cleanup loop that can hang the server process indefinitely. The vulnerability is exploitable remotely without authentication by simply sending a malicious HTTP cookie header. The issue has been addressed in h3 version 2.0.1-rc.18. Affected users should upgrade immediately to mitigate the risk of service disruption.
View original advisory →A SQL injection vulnerability has been identified in SourceCodester Class and Exam Timetabling System version 1.0. The vulnerability exists in the mysqli_query function within the file /admin/modal_add_course2.php. An attacker can manipulate the 'course' argument to perform SQL injection attacks. The attack can be launched remotely without requiring physical access. A public exploit has been disclosed, making this vulnerability actively exploitable. The affected product is a web-based academic scheduling system. No authentication bypass details are specified, but remote exploitation increases the risk significantly. The vulnerability has been assigned CVE-2026-86222 and is tracked by NVD and VulDB.
View original advisory →A vulnerability has been identified in Mstfakts College-Management-System affecting the login.php file in the Front-end directory. The flaw involves improper authentication through manipulation of the email argument, allowing attackers to bypass authentication remotely. The exploit has been publicly disclosed and is available for use, increasing the risk of active exploitation. The product uses a rolling release model, meaning no specific version details are available for affected or patched releases. The project maintainer was notified via an issue report but has not yet responded. This lack of response and the public availability of the exploit make this a high-risk vulnerability. No patch or workaround has been officially provided at this time.
View original advisory →A critical OS command injection vulnerability has been identified in Tenda HG10 firmware version 300001138. The vulnerability resides in the formgponConf function within the /boaform/admin/formgponConf file of the Boa web server component. An attacker can manipulate the fmgpon_loid argument to inject and execute arbitrary OS commands. The vulnerability is remotely exploitable without physical access to the device. A public exploit is already available, increasing the risk of active exploitation in the wild. The affected device is a home gateway/router product from Tenda, a widely used networking hardware vendor. This type of vulnerability in IoT/networking devices poses significant risks to home and small business networks. Users of the affected firmware version should apply patches or mitigations as soon as they become available.
View original advisory →A SQL injection vulnerability has been identified in SourceCodester Class and Exam Timetabling System version 1.0. The flaw exists in the /delete_teacher.php file, where manipulation of the 'ID' argument allows SQL injection attacks. The vulnerability can be exploited remotely without requiring physical access to the system. A public exploit has already been released, increasing the risk of active exploitation. The affected product is a web-based timetabling application commonly used in educational institutions. Attackers could potentially access, modify, or delete database contents through this vulnerability. The issue has been catalogued in VulDB and reported via GitHub. Users of the affected system are advised to apply patches or mitigations immediately.
View original advisory →A new unpatched zero-day vulnerability dubbed 'StyleSmuggler' has been discovered in Magento Open Source and Adobe Commerce by Dutch e-commerce security company Sansec. The flaw allows attackers to execute malicious code on online store servers without requiring authentication. Active exploitation began on September 4, 2026, with Sansec publishing an early advisory on September 5. The vulnerability poses a critical risk to e-commerce operators using affected platforms, potentially enabling full server compromise and store backdooring. No patch was available at the time of disclosure, making this a high-severity zero-day threat targeting the e-commerce ecosystem.
View original advisory →Unidentified threat actors exploited a recently disclosed critical vulnerability in JetBrains TeamCity to breach JetBrains' own Cadence environment. The attackers successfully extracted AWS credentials during the intrusion. JetBrains has issued an urgent advisory for all Cadence users to immediately revoke or rotate any credentials and secrets used in Cadence executions. The incident highlights the risk of unpatched CI/CD infrastructure, particularly in widely used developer tooling platforms. The breach underscores the supply chain risk posed when development pipeline tools like TeamCity are left unpatched. JetBrains has not publicly identified the threat actors responsible for the attack.
View original advisory →